@kybernesis/create 0.14.5 → 0.14.6

package/dist/init.js

@@ -74,7 +74,19 @@ export async function init(rawName, options = {}) {
     // refuses an id it cannot find in the AI Gateway catalog and then creates
     // nothing at all, and an exe-hosted agent takes its model from EXE_MODEL,
     // not from the gateway.
-    run("npx", [`eve@${EVE_VERSION}`, "init", name], { allowFail: true });
+    // Two guards, both learned on a real Factory build (KYB-521):
+    //  - AI_AGENT: eve's init hands off to `eve dev --onboard` when it sees no
+    //    interactive terminal, and that is a server that waits for a person, so a
+    //    headless `kyb init` never returned. eve skips the handoff and prints its
+    //    summary when it believes a coding agent launched it; the marker is
+    //    stripped from eve's own child spawns, so nothing else sees it.
+    //  - a timeout, because `--yes` cannot reach a choice eve makes internally,
+    //    and a scaffold that cannot finish must fail, not wait forever.
+    run("npx", [`eve@${EVE_VERSION}`, "init", name], {
+        allowFail: true,
+        env: { AI_AGENT: process.env.AI_AGENT?.trim() || "kybernesis-create" },
+        timeoutMs: 20 * 60_000,
+    });
     // The real test of that step, since its exit code cannot be trusted.
     if (!existsSync(join(dir, "package.json"))) {
         console.error(red(`\n  eve did not create a project in ${dir}. Nothing else can run.`));

package/dist/upgrade.js

@@ -424,13 +424,16 @@ function dependencyEntries(pkg) {
 function rewriteManifest(cwd, pkg, targets) {
     for (const target of targets) {
         const section = pkg[target.section];
-        section[target.name] = `^${target.targetVersion}`;
+        // eve is pinned exactly: the pin IS the certification. A caret let a
+        // clean install resolve eve@0.49.1 against a certified 0.49.0 (blind
+        // latest, the one thing kyb upgrade exists to prevent).
+        section[target.name] = target.name === "eve" ? target.targetVersion : `^${target.targetVersion}`;
     }
     writeFileSync(join(cwd, "package.json"), `${JSON.stringify(pkg, null, 2)}\n`);
 }
 function recoveryGuidance(targets, bridgeUnit) {
     console.log(`\n${yellow("The dependency tree was not verified. Complete the clean install before using it:")}\n` +
-        `  1. Ensure every root @kybernesis/* and eve range in package.json is the resolved ^version.\n` +
+        `  1. Ensure every root @kybernesis/* range in package.json is the resolved ^version, and eve is pinned exactly to ${EVE_VERSION}.\n` +
         `  2. ${dim("rm -rf node_modules")}\n` +
         `  3. ${dim("rm -f package-lock.json")}\n` +
         `  4. ${dim("npm install")}\n` +
@@ -592,8 +595,15 @@ export async function upgrade(options = {}) {
             return;
         }
     }
-    const installArgs = cleanInstall ? ["install"] : ["install", ...changed];
-    const installed = commandResult("npm", installArgs, cwd);
+    // Outside a clean install, eve goes in with --save-exact for the same
+    // reason rewriteManifest pins it: npm would save a caret by default.
+    const eveChange = changed.find((spec) => spec.startsWith("eve@"));
+    const others = changed.filter((spec) => spec !== eveChange);
+    const installArgs = cleanInstall ? ["install"] : ["install", ...others];
+    let installed = cleanInstall || others.length > 0 ? commandResult("npm", installArgs, cwd) : { status: 0, stdout: "", stderr: "" };
+    if (installed.status === 0 && !cleanInstall && eveChange) {
+        installed = commandResult("npm", ["install", "--save-exact", eveChange], cwd);
+    }
     if (installed.status !== 0) {
         const output = `${installed.stdout}\n${installed.stderr}`;
         if (/ERESOLVE/i.test(output)) {

package/dist/util.d.ts

@@ -10,6 +10,10 @@ export declare function run(command: string, args: string[], options?: {
     cwd?: string;
     allowFail?: boolean;
     quiet?: boolean;
+    /** Extra environment for this one child; the parent's is inherited underneath. */
+    env?: Record<string, string>;
+    /** Kill the child after this many milliseconds. A command that cannot finish is a failure, not a wait. */
+    timeoutMs?: number;
 }): boolean;
 export declare function capture(command: string, args: string[], cwd?: string, extraEnv?: Record<string, string>): string | null;
 export declare function ask(question: string, fallback: string): Promise<string>;

package/dist/util.js

@@ -15,8 +15,12 @@ export function run(command, args, options) {
     const result = spawnSync(command, args, {
         cwd: options?.cwd,
         stdio: options?.quiet ? "pipe" : "inherit",
-        env: process.env,
+        env: { ...process.env, ...options?.env },
+        timeout: options?.timeoutMs,
     });
+    if (result.error && result.error.code === "ETIMEDOUT") {
+        console.error(red(`Command did not finish within ${Math.round((options?.timeoutMs ?? 0) / 60_000)} min and was stopped: ${command} ${args.join(" ")}`));
+    }
     const ok = result.status === 0;
     if (!ok && !options?.allowFail) {
         console.error(red(`Command failed: ${command} ${args.join(" ")}`));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.14.5",
-  "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent \u2014 plus doctor and upgrade.",
+  "version": "0.14.6",
+  "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",
   "homepage": "https://kybernesis.ai",